Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, and snapshot list and snapshot remove act as for
a destination that cannot be listed. remote nuke deletes it last. The
file:// backend no longer creates its destination directory and checks
for it on every write; that protects a directory on a removable
volume, not a mount point.

Fixtures standing for a written destination carry the marker; two
tests check they get past it.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection moved
into snapshotNamesToCreate and the --force/--json test into
confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

internal/storage/storer.go

@@ -41,7 +41,8 @@ type Info struct {
 // directory for filesystem).
 type Storer interface {
 	// Put stores data at the specified key.
-	// Parent directories are created automatically for filesystem backends.
+	// The filesystem backend fails when its destination directory does
+	// not exist, and creates the directories below it as needed.
 	Put(ctx context.Context, key string, data io.Reader) error
 
 	// PutWithProgress stores data with progress reporting.